Repository navigation
feat: professionalize the plugin - spec-compliant skills, hardened CLI/hooks, consistency gate - #1
Merged
Conversation
…I/hooks, consistency gate Skills - drop the non-spec "version" key from all 22 SKILL.md (it is not in the Agent Skills allow-list and would hard-fail packaging/upload) and use the allowed "license" key instead - make every description trigger-first and enforce it in tests - unify the forbidden-pattern section across all 22 code-guides (16 renames + 6 new) and enforce a structural contract CLI - derive the skill count by enumerating skills/ instead of hardcoding 22 - uninstall --host now handles the bundle kind (was a silent no-op) via an explicit kind -> action map, and removes the bundle group as a whole - reference-count shared instruction files and shared skill dirs so uninstalling one host never deletes artifacts another host still uses - verify detects asset drift (modified / missing / unmanaged) from recorded SHA-256 - scan errors also emit JSON when --format json is requested Hooks - rules carry a stable rule_id / severity / guide; every rule now has a positive AND a negative fixture (8 rules had no false-positive guard) - file_category matches exact path segments and filename patterns, so latest.cc is no longer treated as a test file - SessionStart matcher covers resume; session-start strips C0 control characters and degrades gracefully - --scan --format without a value exits 2 instead of raising IndexError Tooling and CI - add scripts/check-consistency.py (12 cross-artifact checks) and scripts/plugin-capabilities.json (CLI capability contract) - pin dev dependencies in requirements-dev.txt, enable the pip cache, run the gate in CI - pin LF for the extensionless hook scripts; a Windows checkout with core.autocrlf would otherwise hand CRLF to bash and silently break both hooks Tests: 47 -> 127. Gates: 0 -> 12. All green.
…d-2 three-axis review docs/PROFESSIONALIZATION-REVIEW.md - quantified baseline, A/B/C/D gap list, weighted priorities, acceptance criteria and toolchain recommendations (diagnosis only, nothing installed) docs/SKILL-AUTHORING.md - the how-to for adding or changing a skill: allowed frontmatter, trigger phrasing, code-guide contract, four-way sync checklist and the hook-rule workflow docs/SPEC-CORRECTNESS-COMPAT-REVIEW.md - round-2 review across spec compliance, functional correctness and multi-host compatibility; records the claims refuted by official docs and the items that need real-host verification README / CONTRIBUTING: document the CI gate, pinned dev requirements, the skill authoring manual and the manual verification checklist CHANGELOG: record both rounds under Unreleased (no version bump)
Hook layer: whitelist to blacklist + Codex apply_patch patch parsing (R3), fork in SessionStart matcher with set-coverage assertions (R2), stdin reconfigured utf-8+replace so invalid bytes degrade without losing the scan (P1), malformed payloads and unexpected errors never traceback (R5). CLI: upgrade now scopes to stamped hosts and marker injection is explicit opt-in (R4). Scanner: CFG rules match YAML key forms too (R6). Skill templates: getEventLoopOfCurrentThread null-deref and forwardCoro port/timeout misuse fixed, guarded by a content gate (R7). Spec: marketplace local source "./" (R1), Trae moves from inert .mdc to .trae/skills + AGENTS.md (R10), npm copy restores the exec bit on hook scripts (P2). Consistency gate 12 to 14 checks with mutation-tested guards; CI adds py3.9/3.13 matrix; publish.yml runs pre-publish gates.
pytest 9.x requires Python>=3.10; the ubuntu py3.9 job failed with "No matching distribution found for pytest==9.1.1". Requirements-file markers are evaluated by the installing interpreter, so the 3.9 runner picks 8.4.2 (last 3.9-capable series) and >=3.10 runners keep 9.1.1.
wangrh0909
approved these changes
Sep 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
对一个成熟的 Drogon C++ coding-agent 插件仓库做了一轮专业化体检 + 两轮评审整改。不引入任何新工具链（运行时依赖仍为零），能固化的约束都固化成自动化门禁。
改了什么
技能层（22 个）
CLI（PyPI 与 npm）
钩子
工具链与 CI
文档
验证
说明
第三轮评审整改(追加)
评审记录:
docs/ROUND3-SPEC-HOST-PLATFORM-CORRECTNESS-REVIEW.md(四维度:规范符合性 / 宿主兼容性 / 平台兼容性 / 功能正确性,官方文档逐条二次核实)。按 §6 优先级三个批次全部落地:钩子层(批次①)
apply_patch(Write/Edit只是 matcher 别名)→ 工具名白名单改黑名单,新增补丁文本解析(按*** Update/Add File:头逐文件扫+新增行);matcher 补apply_patchfork(R2);测试与门禁由"子串含 resume"弱断言升级为全来源集合覆盖断言utf-8+replace重配置,非法字节降级不丢扫描tool_input非 dict /edits字符串数组优雅降级 + 钩子分支整体 try 兜底CLI 与扫描器(批次②)
upgrade破坏安装契约(R4):不再无条件 ALL_HOSTS 重装 + 强推标记段;范围 = 安装戳已装宿主,--host/--force-agents显式 opt-in(?<![\w."])边界防误报getEventLoopOfCurrentThread()->(必崩空指针)→ 捕获req->getLoop();forwardCoro(req, host, port)(第三参是 timeout 非端口)→"host:port";新增技能文档已知错误模式内容门禁规范落点(批次③)
"."→"./"(R1,官方硬约束)并进门禁.trae/rules/*.mdc(R10,V4 证伪),改.trae/skills+AGENTS.md双通道,旧产物进无戳兜底清扫copyFileSync丢可执行位(P2):copyAssets后对 4 个钩子文件chmodSync(0o755)门禁与 CI(批次⑤)
遗留(按报告批次④"按需"):N3/N4/N5(未投放宿主的技能通道)、L1–L7、真机核实项 V6–V8 未在本轮处理。